CVE-2026-19398 Memory corruption in FA507NU
A local administrator can trigger a system crash or BIOS corruption via an out-of-bounds write in the ASUS BIOS SMM module.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-19398?
CVE-2026-19398 is a medium-severity memory corruption vulnerability in ASUS FA507NU, published on 27 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An out-of-bounds write in the SmiFlash SMM module of ASUS FA507NU and FA507NV BIOS allows a local administrator to cause a system crash (BSOD) or BIOS corruption via a crafted software SMI (SW SMI) request with an oversized length value.Refer to the ' Security Update for ASUS FA507NV / FA507NU BIOS ' section on the ASUS Security Advisory for more information.
Weakness: CWE-787
Which versions are affected by CVE-2026-19398?
How do I fix CVE-2026-19398?
No fix has been published for CVE-2026-19398 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-19398 being exploited?
There is no known exploitation of CVE-2026-19398 in the wild and no public exploit code.
Sources
Also known as GHSA-mqcp-4543-826g.